When a conversational AI says something it should not, the public conversation focuses on the model. The quieter problem is that guardrail design — what gets blocked, flagged, or rerouted — involves continuous judgment calls that sit entirely with the people building the system.
Input filters and output filters solve different problems
Input filtering catches problematic user requests before the model processes them. Output filtering reviews model responses before they reach the user. Running both adds latency, typically 200–400 milliseconds per turn depending on classifier complexity. Most production systems accept that cost because catching harmful output before delivery matters more than speed at the margins.
Where the real design work happens
The hard decisions are in the gray zones. A user describing a difficult personal situation could be seeking information, emotional acknowledgment, or professional referral. A system that blocks all sensitive queries fails users who need engagement. One that handles everything without escalation paths creates different risks.
Teams at companies like Neon and Inflection documented their safety layer architectures in 2023 and 2024. A recurring theme was the need for human-readable decision logs — not for audit purposes alone, but because the guardrail logic needs to be debuggable when edge cases surface in production.
You do not finish designing guardrails at launch. You start there.